roster-server 2.1.20 → 2.1.23

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.20",
+    "version": "2.1.23",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {

package/vendor/acme-dns-01-cli-wrapper.js

@@ -2,6 +2,7 @@
 
 const legacyCli = require('acme-dns-01-cli');
 const log = require('lemonlog')('acme-dns-01');
+const dns = require('node:dns').promises;
 
 function toPromise(fn, context) {
     if (typeof fn !== 'function') {
@@ -60,16 +61,72 @@ module.exports.create = function create(config = {}) {
         : Number.isFinite(Number(process.env.ROSTER_DNS_DRYRUN_DELAY_MS))
             ? Number(process.env.ROSTER_DNS_DRYRUN_DELAY_MS)
             : propagationDelay;
+    const parseBool = (value, fallback) => {
+        if (value === undefined || value === null || value === '') return fallback;
+        const normalized = String(value).trim().toLowerCase();
+        if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+        if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+        return fallback;
+    };
+    const verifyDnsBeforeContinue = config.verifyDnsBeforeContinue !== undefined
+        ? parseBool(config.verifyDnsBeforeContinue, true)
+        : parseBool(process.env.ROSTER_DNS_VERIFY_BEFORE_CONTINUE, true);
+    const dnsPollIntervalMs = Number.isFinite(config.dnsPollIntervalMs)
+        ? config.dnsPollIntervalMs
+        : Number.isFinite(Number(process.env.ROSTER_DNS_POLL_INTERVAL_MS))
+            ? Number(process.env.ROSTER_DNS_POLL_INTERVAL_MS)
+            : 5000;
+    const dnsPollTimeoutMs = Number.isFinite(config.dnsPollTimeoutMs)
+        ? config.dnsPollTimeoutMs
+        : Number.isFinite(Number(process.env.ROSTER_DNS_POLL_TIMEOUT_MS))
+            ? Number(process.env.ROSTER_DNS_POLL_TIMEOUT_MS)
+            : null;
 
     function sleep(ms) {
         return new Promise((resolve) => setTimeout(resolve, ms));
     }
 
+    function normalizeTxtChunk(value) {
+        return String(value || '').replace(/^"+|"+$/g, '');
+    }
+
+    function resolveExpectedToken(opts, ch) {
+        const candidate = ch?.dnsAuthorization || opts?.dnsAuthorization;
+        return candidate ? String(candidate).trim() : '';
+    }
+
+    async function hasDnsTxtToken(dnsHost, expectedToken) {
+        if (!dnsHost || !expectedToken) return false;
+        try {
+            const records = await dns.resolveTxt(dnsHost);
+            for (const recordParts of records || []) {
+                const joined = (recordParts || []).map(normalizeTxtChunk).join('').trim();
+                if (joined === expectedToken) return true;
+            }
+            return false;
+        } catch (_) {
+            return false;
+        }
+    }
+
+    async function waitForDnsTxtPropagation(dnsHost, expectedToken, timeoutMs) {
+        const started = Date.now();
+        const maxWait = Math.max(0, Number.isFinite(timeoutMs) ? timeoutMs : 0);
+        if (maxWait === 0) return hasDnsTxtToken(dnsHost, expectedToken);
+
+        while ((Date.now() - started) <= maxWait) {
+            if (await hasDnsTxtToken(dnsHost, expectedToken)) return true;
+            await sleep(Math.max(1000, dnsPollIntervalMs));
+        }
+        return false;
+    }
+
     const presentedByHost = new Map();
+    const presentedByAltname = new Map();
 
     async function setChallenge(opts) {
         const isInteractive = Boolean(process.stdin && process.stdin.isTTY);
-        if (isInteractive && !autoContinue) {
+        if (isInteractive && !autoContinue && !verifyDnsBeforeContinue) {
             return toPromise(challenger.set, challenger)(opts);
         }
 
@@ -83,10 +140,16 @@ module.exports.create = function create(config = {}) {
         if (dnsHost && dnsAuth) {
             presentedByHost.set(dnsHost, dnsAuth);
         }
+        const altname = String(ch.altname || opts?.altname || '');
+        if (altname && dnsAuth) {
+            presentedByAltname.set(altname, { dnsHost, dnsAuthorization: dnsAuth });
+        }
         const isDryRunChallenge = dnsHost.includes('_greenlock-dryrun-');
         const effectiveDelay = isDryRunChallenge
             ? Math.max(0, dryRunDelay)
             : propagationDelay;
+        const effectiveTimeoutMs = dnsPollTimeoutMs === null ? effectiveDelay : dnsPollTimeoutMs;
+        const expectedToken = resolveExpectedToken(opts, ch);
 
         log.info(
             '\tTXT\t' +
@@ -96,6 +159,28 @@ module.exports.create = function create(config = {}) {
                 '\tTTL 60'
         );
         log.info('');
+        if (verifyDnsBeforeContinue && dnsHost && expectedToken) {
+            log.info(
+                'DNS verification enabled. Continuing automatically when TXT appears at ' +
+                dnsHost +
+                ' (timeout ' +
+                effectiveTimeoutMs +
+                'ms, poll ' +
+                dnsPollIntervalMs +
+                'ms).'
+            );
+            const propagated = await waitForDnsTxtPropagation(dnsHost, expectedToken, effectiveTimeoutMs);
+            if (propagated) {
+                log.info(`DNS TXT detected for ${dnsHost}; continuing ACME flow.`);
+                return null;
+            }
+            log.warn(
+                `DNS TXT not detected for ${dnsHost} within ${effectiveTimeoutMs}ms; ` +
+                'continuing anyway (ACME preflight may still fail).'
+            );
+            return null;
+        }
+
         log.info(
             'Non-interactive mode (or autoContinue) detected. ' +
             'Set the TXT record now. Continuing automatically in ' +
@@ -108,11 +193,18 @@ module.exports.create = function create(config = {}) {
 
     async function getChallenge(opts) {
         const ch = opts?.challenge || {};
-        const dnsHost = String(ch.dnsHost || opts?.dnsHost || '');
+        const altname = String(ch.altname || opts?.altname || '');
+        const wildcardZone = altname.startsWith('*.') ? altname.slice(2) : '';
+        const dnsHostFromAltname = wildcardZone ? `_acme-challenge.${wildcardZone}` : '';
+        const dnsHost = String(ch.dnsHost || opts?.dnsHost || dnsHostFromAltname || '');
+
+        const byAltname = altname ? presentedByAltname.get(altname) : null;
         const dnsAuthorization =
             ch.dnsAuthorization ||
             opts?.dnsAuthorization ||
-            (dnsHost ? presentedByHost.get(dnsHost) : null);
+            (dnsHost ? presentedByHost.get(dnsHost) : null) ||
+            byAltname?.dnsAuthorization ||
+            null;
 
         if (!dnsAuthorization) {
             return null;
@@ -120,6 +212,8 @@ module.exports.create = function create(config = {}) {
 
         return {
             ...(typeof ch === 'object' ? ch : {}),
+            ...(altname ? { altname } : {}),
+            ...(dnsHost ? { dnsHost } : {}),
             dnsAuthorization
         };
     }